无法通过 ASA 5512 从路由器（外部）访问 PC（内部）

网络工程 思科-ASA
2022-02-14 03:10:15

我有一个无法解决的严重问题。感谢你们对我的帮助。
我有一个配置为 ASA 5512（内部、外部、DMZ）的网络运行良好。现在我想使用图形实用程序能够对思科所有设备进行集中管理。但我无法从路由器 ping 局域网机器，而且 CCP 图形实用程序看不到。但是我从局域网里面访问路由器。这是我的基本配置

IP firewall: 192.168.100.253  
IP router: 192.168.100.254  
inside: 192.168.0.0/24  
outside: 192.168.100./24  
DMZ: 1923.168.1.0/24

我可以通过这种方式访问​​互联网
路由器->防火墙->内部和DMZ
我认为防火墙阻止了路由器与LAN的任何通信（内部是bormal）。
但我希望路由器与我的管理员 PC 或位于 LAN 中的任何其他 PC 通信。为此，我为地址 192.168.100.254 定义了 nat（外部、内部）和访问规则，但我仍然无法通过路由器地址通过防火墙。这是我的防火墙配置

ASA Version 9.1(2)
!  
hostname teropaz
enable password HiGcJ9e0GTkEROyY encrypted
names  
ip local pool DHCP_VPN 192.168.0.150-192.168.0.160 mask 255.255.255.0  
ip local pool DHCP_VPN1 192.168.1.40-192.168.1.50 mask 255.255.255.0  
!  
interface GigabitEthernet0/0
 nameif outside  
 security-level 0  
 ip address 192.168.100.253 255.255.255.0  
!  
interface GigabitEthernet0/1  
 nameif inside  
 security-level 100  
 ip address 192.168.0.254 255.255.255.0  
!  
interface GigabitEthernet0/2  
 nameif dmz  
 security-level 50  
 ip address 192.168.1.254 255.255.255.0  
!    
interface GigabitEthernet0/3  
 shutdown  
 no nameif  
 no security-level  
 no ip address  
!  
interface GigabitEthernet0/4  
 shutdown  
 no nameif  
 no security-level  
 no ip address  
!  
interface GigabitEthernet0/5  
 shutdown  
 no nameif  
 no security-level  
 no ip address  
!  
interface Management0/0  
 management-only  
 nameif management  
 security-level 100  
 ip address 192.168.3.1 255.255.255.0  
!  
ftp mode passive  
dns domain-lookup outside  
dns domain-lookup inside  
dns domain-lookup dmz  
dns domain-lookup management  
same-security-traffic permit inter-interface  
same-security-traffic permit intra-interface  
object network INSIDE-LAN-SUBNET  
 subnet 192.168.0.0 255.255.255.0  
object network DMZ-LAN-SUBNET  
 subnet 192.168.1.0 255.255.255.0  
object network dmz  
 subnet 192.168.1.0 255.255.255.0  
object network Sortie_IP_CAMTEL  
 host 154.107.154.178  
object network webserver  
 host 192.168.1.103  
object network NETWORK_OBJ_192.168.0.128_26  
 subnet 192.168.0.128 255.255.255.192  
object network NETWORK_OBJ_192.168.1.32_27  
 subnet 192.168.1.32 255.255.255.224  
object network ROUTER-INSIDE  
 host 192.168.100.254  
object-group service HTTP_HTTPS  
 service-object tcp destination eq www  
 service-object tcp destination eq https  
access-list outside_acl extended permit tcp any object webserver eq www  
access-list dmz_access_in extended permit ip any 192.168.0.0 255.255.255.0  
access-list dmz_access_in extended permit ip 192.168.1.0 255.255.255.0 192.168.0.0  
 255.255.255.0  
access-list dmz_access_in extended permit object-group HTTP_HTTPS 192.168.1.0 255.255.255.0 any  
access-list dmz_access_in extended permit ip 192.168.1.0 255.255.255.0 any  
access-list global_access extended permit ip  object ROUTER-INSIDE object INSIDE-LAN-SUBNET 
access-list global_access extended permit icmp  
object ROUTER-INSIDE object INSIDE-LAN-SUBNET  
mtu outside 1500  
mtu inside 1500  
mtu dmz 1500  
mtu management 1500  
no failover  
icmp unreachable rate-limit 1 burst-size 1  
no asdm history enable  
arp timeout 14400  
no arp permit-nonconnected  
nat (inside,outside) source static any any destination static  
 NETWORK_OBJ_192.168.0.128_26  
 NETWORK_OBJ_192.168.0.128_26 no-proxy-arp route-lookup
nat (inside,outside) source static any any destination static  
 NETWORK_OBJ_192.168.1.32_27 NETWORK_OBJ_192.168.1.32_27 no-proxy-arp route-lookup  
nat (outside,inside) source static any ROUTER-INSIDE  
!  
object network INSIDE-LAN-SUBNET  
 nat (inside,outside) dynamic interface  
object network DMZ-LAN-SUBNET  
 nat (dmz,outside) dynamic interface  
object network webserver  
 nat (dmz,outside) static Sortie_IP_CAMTEL  
 service tcp www www  
access-group outside_acl in interface outside  
access-group dmz_access_in in interface dmz  
access-group global_access global  
route outside 0.0.0.0 0.0.0.0 192.168.100.254 1  
timeout xlate 3:00:00  
timeout pat-xlate 0:00:30  
timeout conn 1:00:00  
half-closed 0:10:00  
udp 0:02:00 icmp 0:00:02  
timeout sunrpc 0:10:00 h323 0:05:00 h225  
 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute  
timeout tcp-proxy-reassembly 0:01:00  
timeout floating-conn 0:00:00  
dynamic-access-policy-record DfltAccessPolicy  
user-identity default-domain LOCAL  
http server enable  
http 192.168.3.0 255.255.255.0 management  
no snmp-server location  
no snmp-server contact  
telnet timeout 5  
ssh timeout 5  
ssh key-exchange group dh-group1-sha1  
console timeout 0  
threat-detection basic-threat  
threat-detection statistics access-list  
no threat-detection statistics tcp-intercept
tftp-server inside 192.168.2.254 \\SaveConfigCisco\aa  

!  
class-map inspection_default
 match default-inspection-traffic
!  
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy  
 class inspection_default  
  inspect dns preset_dns_map  
  inspect ftp  
  inspect h323 h225  
  inspect h323 ras  
  inspect rsh  
  inspect rtsp  
  inspect esmtp  
  inspect sqlnet  
  inspect skinny  
  inspect sunrpc  
  inspect xdmcp  
  inspect sip  
  inspect netbios  
  inspect tftp  
  inspect ip-options  
  inspect icmp  
!  
service-policy global_policy global  
prompt hostname context  
no call-home reporting anonymous
Cryptochecksum:6b52d456c89ffc95b92c353bf4c5467a
: end  
ciscoasa#

这是路由器配置

Current configuration : 9240 bytes
!
! Last configuration change at 16:03:54 UTC Thu Dec  
20 2018
version 15.3

!  
hostname xxxx  
!  
boot-start-marker  
boot system tftp c2900-universalk9-mz.SPA.156-1.T1.bin 255.255.255.255  
boot system flashO:/c2900-universalk9-mz.SPA.155-3.M3.bin  
boot system flash0:/c2900-universalk9-mz.SPA.153-3.M3.bin  
boot-end-marker  
!  
aqm-register-fnf  
!  
! card type command needed for slot/vwic-slot 0/0  
no logging console  
enable secret 4 tnhtc92DXBhelxjYk8LWJrPV36S2i4ntXrpb4RFmfqY  
!  
no aaa new-model  
!  
!  
no ip domain lookup  
ip domain name savannah-osc.com  
ip cef  
no ipv6 cef  
multilink bundle-name authenticated  
!!  
!  
voice-card 0  
!  
!  
!license udi pid CISCO2911/K9 sn FTX1807AHKY  
license accept end user agreement  
license boot module c2900 technology-package uck9
hw-module pvdm 0/0  
!  
!  
file privilege 0  

redundancy  
!  
!  
interface Embedded-Service-Engine0/0  
 no ip address  
 shutdown  
!  
interface GigabitEthernet0/0  
 description INTERFACE INTERNET  
 ip address 154.72.154.122 255.255.252.0  
 ip nat outside  
 ip virtual-reassembly in  
 duplex auto  
 speed auto  
!  
interface GigabitEthernet0/1  
 description INTERFACE LAN INTERNE  
 ip address 192.168.100.254 255.255.255.0  
 ip access-group 101 in  
 ip nat inside  
 ip virtual-reassembly in  
 duplex auto  
 speed auto  
!  
interface GigabitEthernet0/2  
 ip address 192.168.5.1 255.255.255.0  
 duplex auto  
 speed auto  
!  
ip forward-protocol nd  
!  
ip http server  
ip http port 8080  
ip http authentication local  
ip http secure-server  
ip http path flash:  
!  
ip nat inside source list 1 interface   
 GigabitEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 154.107.154.178  
!  
!  
access-list 1 permit 192.168.100.0 0.0.0.255  
access-list 10 permit 192.168.100.0 0.0.0.255  
!  
control-plane  
!  
 login local  
 transport input all  
line vty 5 15  
 password 74éz_iào555*$£  
 login local  
 transport input all  
!  
scheduler allocate 20000 1000  
!  
end
1个回答

可以从外部建立的唯一连接由此访问列表定义：

access-list outside_acl extended permit tcp any object webserver eq www

您需要添加到您的访问列表以允许您的路由器访问您的管理主机。

编辑

在路由器接口上

interface GigabitEthernet0/1

你有这个 ACL：

 ip access-group 101 in

但是该 ACL 不存在，因此它将丢弃所有流量。

其它你可能感兴趣的问题
上一篇使用 NFC 分接点对 WiFi 用户进行身份验证 下一篇Quanta 交换机无法解析地址